Online Art Gallery Shop CVE-2026-10874

Q: What is the CVSS score of CVE-2026-10874?

CVE-2026-10874 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34542 LOW

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

2026-06-04 cna@vuldb.com

GHSA-rv9g-w73w-5xx8

PHP SQLi

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 04, 2026 - 23:30 vuln.today

DescriptionCVE.org

A vulnerability was identified in projectworlds Online Art Gallery Shop Project 1.0. The affected element is an unknown function of the file /admin/adminHome.php. The manipulation of the argument social_insta leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

AnalysisAI

SQL injection in projectworlds Online Art Gallery Shop 1.0 enables remote low-privileged attackers to manipulate the social_insta parameter within /admin/adminHome.php, achieving limited read, write, and availability impact against the underlying database. Publicly available exploit code exists (CVSS 4.0 E:P), though the overall CVSS 4.0 score of 2.1 reflects a constrained impact scope - no subsequent system compromise is possible. This is not listed in the CISA KEV catalog; exploitation requires authenticated access rather than open unauthenticated attack.

Technical ContextAI

Online Art Gallery Shop 1.0 is a PHP-based web application distributed by projectworlds. The vulnerability resides in the admin-panel script /admin/adminHome.php, where the social_insta POST/GET parameter is passed directly into a SQL query without sanitization or parameterization. CWE-74 (Injection) covers cases where user-controlled input is interpreted as code or command by an interpreter - here, attacker-supplied values are treated as SQL syntax by the backend database engine. No CPE string was included in the provided intelligence data, but the product is identified by name and version (1.0) from VulDB. Tags confirm PHP language and SQL injection as the attack class.

RemediationAI

No vendor-released patch or official advisory has been identified from the available references - patch status is unknown based on current data. The primary remediation is to replace direct string interpolation in the social_insta parameter with parameterized prepared statements (e.g., PDO or MySQLi with bound parameters) in /admin/adminHome.php. As a compensating control, restrict access to the /admin/ directory via web server configuration using IP allowlisting or HTTP authentication at the server level; note this adds an operational hurdle for legitimate admins. Disabling or removing the social_insta field from the admin interface is a targeted workaround if the feature is not in use. Refer to the researcher disclosure at https://github.com/shq3526/cve/issues/9 and VulDB entry https://vuldb.com/vuln/368364 for further context.